CVE-2026-55369 walinejs CVE debrief

Who should care

Defenders responsible for Waline deployments should assess exposure and verify the email input type to prevent similar authentication bypass vulnerabilities. This includes reviewing the current implementation of the login endpoint, validating user input, and implementing additional security measures to protect against potential attacks. Security teams should also monitor for suspicious login attempts and implement rate limiting to prevent credential-stuff

Why it matters

This vulnerability allows an attacker to partially bypass authentication and test a leaked or weak password against the administrator account without knowing the administrator's email. Defenders should prioritize verifying the email input type and validating user input to prevent similar authentication bypass vulnerabilities.

• An attacker can test a leaked or weak password against the administrator account without knowing the administrator's email
• The email/identifier factor is removed for the administrator account
• User enumeration is possible as a non-string email never fails the 'no such user' branch
• Credential-stuffing amplification is possible

Technical summary

The login endpoint POST /api/token reads the `email` field from the request body without checking its type and passes it straight into the MongoDB storage query. When `email` is not a string, the MongoDB storage adapter's parseWhere silently drops the field rather than rejecting the request, producing an empty filter that matches all users. The endpoint then verifies the submitted password against the first user returned, which is the site administrator. This allows an attacker to test a leaked or weak password against the administrator account without knowing the administrator's email, effectively removing the email/identifier factor for the administrator account and enabling user enumeration and credential-st

Defensive priority

Defenders should prioritize verifying the email input type and validating user input to prevent similar authentication bypass vulnerabilities.

Recommended defensive actions

• Verify the email input type and validate user input to prevent similar authentication bypass vulnerabilities
• Implement additional authentication factors to strengthen the login process
• Monitor for suspicious login attempts and implement rate limiting
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the untyped input in the login endpoint, which allows a non-string email to be passed into the MongoDB storage query. This produces an empty filter that matches all users, and the endpoint verifies the submitted password against the first user returned, which is the site administrator.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.